CVE-2026-69248

A flaw was found in python-cryptography versions 46.0.6 through 48.x. The X.509 verifier incorrectly handles wildcard DNS Subject Alternative Names when evaluating permitted name constraints: a leaf SAN such as *.example.com may be accepted under a more specific permitted subtree (for example foo.example.com), allowing escape to sibling names outside the permitted set. This can lead to acceptance of an invalid certificate chain. Ordinary Web PKI topologies are not affected. This issue is fixed in 49.0.0.

Red Hat rates this Moderate. Exploitation requires a DNS-constrained intermediate CA that issues a broader wildcard leaf SAN than its permitted subtree, which Web PKI does not use. First affected upstream version is 46.0.6 (PR #14542); fixed in 49.0.0 (PR #14888 / GHSA-m2h6-j472-rp4c).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.